CVE-2017-7761

2018-06-1121:00:00

mozilla

www.cve.org

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

25.0%

JSON

The Mozilla Maintenance Service “helper.exe” application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

CNA Affected

[
  {
    "product": "Firefox ESR",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "52.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "54",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]